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23 February 2011 


Mr Allan Chiang 

Privacy Commissioner for Personal Data 

Office of the Privacy Commissioner for Personal Data 
12/F, 248 Queen’s Road East 

Wanchai 

Hong Kong 


Dear Allan, 


Sharing of Positive Mortgage Data 


We note that the Law Society of Hong Kong (the Law Society) has 
made quite a number of comments in its submission on the Consultation 
Document which it has posted on its website. Given our assessment of 
the benefits of the proposal to the overall financial stability in Hong 
Kong and the importance of uploading the existing mortgage data to the 
effective working of the Credit Reference Agency (CRA) in achieving 
the objectives of the proposal, I am writing to provide you with our 
views in relation to the two points set out below which were raised by 
the Law Society in its submission to you, in the first instance. 


(i) 


(ii) 


Issue 1 - Even during the worst of the Asian financial crisis, 
losses due to mortgage defaults were not material. In the view of 
Law Society, this makes it difficult to justify the industry 
proposal on a cost benefit basis; and 


Issue 4 (Issue 3 in the Consultation Document)- Although the 
information on a consumer would be incomplete if pre-existing 
mortgage data is not contributed to the CRA, nevertheless, 
explicit consent from the consumers should be obtained. When 
the original consent was provided by the consumers, they were 
provided under “old” (current) system. It would not be in line 
with the principle of the data protection if information previously 
not provided to the CRA can now be submitted to the CRA 


without consent from the data subject. This is similar to the 
bundled consent versus specific consent issue in relation to direct 
marketing. With the expanded system, specific consent should be 
obtained for all pre-existing mortgages. 


On (i), it is not clear to us what kind of “cost” is referred to in the “cost 
benefit basis” argument. Does it refer to the monetary cost or the cost 
to privacy intrusion? If it is the latter, it has to be recognized that the 
right to personal privacy is not absolute and there is a balancing 
exercise involved between intrusion of privacy and the public interest. 
The proposal has kept the personal data to be transferred (i.e. in the 
form of a mortgage count) to a minimum and sufficient safeguards will 
be put in place to prevent their misuse. Therefore, every effort has 
been made to strike a right balance. If the “cost” refers to “financial 
costs”, the proposal will help credit providers in enhancing the 
completeness and accuracy of their credit risk assessment, thus creating 
a more efficient credit market and reducing the risk of asset bubble in 
the property market as a result of indiscriminate borrowing by some 
consumers and inability of credit providers to indentify borrowers with 
more indebtedness than they can repay. ‘The benefits appear to be 
obvious and far-reaching. 


Also, I would like to point out that financial crises do occur from time 
to time but they are never the same because the overall circumstances 
such as monetary conditions change over time. Therefore, as the 
HKMA has pointed out many times before, the Asian Financial Crisis is 
not a relevant benchmark for reference in this context. It should be 
noted in particular that the overall monetary conditions during the time 
of the Asian Financial Crisis, i.e. from 1997 to 2003, was that the 
mortgage interest rates in Hong Kong were coming down considerably 
(a reduction of around nine percentage points from around 11% to about 
2%) and this substantially eased the burden of borrowers in meeting 
mortgage repayments and hence helped significantly to contain any 
deterioration in the mortgage default rate. On the other hand, given the 
abnormally low interest rate environment at the moment, the mortgage 
interest rates in Hong Kong are expected to revert to a more normal 
level ultimately. If this process coincides with a downward adjustment 
in the property market, which most likely will be the case, this would 
adversely affect the repayment ability of mortgage borrowers as well as 
their will to continue servicing their mortgage loans. For this reason, it 
remains our supervisory judgement from a macro-prudential perspective 
that the fact that the mortgage book of the banking sector in Hong Kong 
performed relatively robustly during the 1997-2003 period is far from a 


guarantee that the same credit performance would be repeated in the 
next property market adjustment cycle. 


When considering this matter, it is also important to bear in mind that 
back in 2003, the number of residential mortgage loans in negative 
equity within the banking sector alone reached a historical high of 
about 106,000 cases with an outstanding mortgage value of HK$165 
billion as at end-June 2003. The unsecured portion of those mortgage 
loans then was estimated at about HK$36 billion, and this negative 
equity amount could increase sharply if repossessed properties were put 
in the market for fire sale during a downward cycle of the property 
market. You could appreciate from the above figures that the potential 
value at risk of mortgage loans could be substantial for our banking 
sector, and could therefore have far-reaching implications for the 
stability of, and thus the public confidence in, the banking sector in 
Hong Kong. This is the main reason for the HKMA seeking to ensure 
that the credit risk management practices of banks could take into 
account the exposures of borrowers in terms of outstanding mortgages 
in order to safeguard the interests of depositors through maintaining 
overall banking stability. The HKMA remains of the strong view that 
there is a clear public interest angle in this regard. 


On (ii), the Law Society's response appears to be indicating a policy 
preference for obtaining customer’s consent rather than a legal 
argument based on a consideration of the relevant provisions of the 
Personal Data (Privacy) Ordinance (PDPO). Specifically, it is not clear 
from the comment on Issue 4 whether the Law Society has considered 
the "directly related purpose" argument as put forth in the Senior 
Counsel’s opinion obtained by the Consumer Credit Forum (CCF) under 
the Hong Kong Association of Banks, a copy of which was previously 
submitted to you. You may wish to see in particular paragraphs 25 to 
31 of the legal opinion which should help explain our and the industry’s 
assessment of the legal position on Issue 4. 


For your ease of reference, we have extracted these paragraphs below. 
“25. DPP3 should be interpreted in the following manner: 


(a) having regard to the wording of DPP3(a), the purposes 
covered by DPP3(a) are the purposes that were within the 


reasonable contemplation or expectation of the Customer 
or could be reasonably inferred as the customer’s purpose 


at the time of the mortgage loan application when his data 


26. 


27. 


28. 


were collected by the institution to which the application 
was made (the “Original Purposes”); 


(b) DPP3(b) provides for a purpose directly related to the 
purpose referred to in DPP3(a). There is no ambiguity 
between the wording of DPP3(b) and the wording of 
DPP3(a). By separating DPP3(b) from DPP3(a) and not 
repeating in DPP3(b) the reference to “at the time of the 
collection of the data” which appears in DPP3(a), it is 
clear that the legislative intent is that a “directly related 
purpose” should be determined by whether it is directly 
related to an Original Purpose but without imposing a 


specific timeframe for the making of that determination. 


I note that the PCPD on DPP3 in its book entitled “Data 
Protection Principles in the Personal Data (Privacy) Ordinance” 
(the “Book”) considers this very issue. In particular, paragraph 
7.26 of the Book provides that the PCPD will take into account 
factors, such as the following, in assessing whether the act in 
question is done for a “directly related purpose” and thus 
covered by DPP3(b): 





(a) the nature of the transaction giving rise to the need for the 
using the personal data ; and 


(b) the reasonable expectation of the data subject. 


For the reasons set out above, interpretation of DPP3(b) in the 
manner described in paragraph 25 above substantially reflects 
both the letter of the provision and the legislative intent. 
Purpose can however also be a matter of inference, from all the 
circumstances. The question as to whether a purpose is a 
“directly related purpose” is determined by whether it is directly 
related to an Original Purpose and is not dependent on whether 
the Customer reasonably contemplated or expected that “directly 
related purpose” at the time of the mortgage loan application 
when his personal data were collected. This interpretation does 
not contradict the PCPD’s approach and is in accordance with 
both it and the careful dichotomy made between DPP3(a) and 
DPP3(b), which eliminates any fixed initial time-point for 
DPP3(b). 





Further, I note the PCPD’s comment in paragraph 7.30 of the 
Book that in the context of human resource management, 


disclosure of employees’ personal data to Mandatory Provident 
Fund (“MPF”) providers for the administration of the MPF 
scheme is an example of use of data for a directly related 
purpose. 


29. The MPF regime was only implemented in Hong Kong in the year 
2000. Employers would not therefore have explicitly specified in 
the PDPO Notice distributed by them to employees before 
implementation of the MPF regime, that disclosure of employees’ 
personal data to MPF providers was an Original Purpose. 
Moreover, such disclosure would not have been in the reasonable 
contemplation of the employees when their data were collected 
before the implementation of the MPF regime. 


30. In that regard, the MPF regime is similar to the regime for 
sharing positive mortgage data in that collection of personal data 
pre-dated the implementation of the regime. On that basis of 
ambulatory interpretation, my opinion as to the interpretation of 
DPP3(b) is fully consistent with the PCPD’s treatment of transfer 
of employees’ personal data to MPF providers, as being a 
directly related purpose in the context of human resources 
management. 


31. Adopting this interpretation of DPP3, granting and maintaining 
the mortgage loan are Original Purposes and ensuring ongoing 
credit worthiness of the Customer is a purpose directly related to 
those Original Purposes. Transfer of the Customer’s personal 
data to the CRA under Step 1 is aimed at ensuring ongoing 
credit-worthiness of the Customer and is directly related to the 
Original Purposes and thus covered by DPP3(b).” 


As can be seen from the above extracts, what is required is a purposive 
statutory analysis which ought reasonably to lead to the view that the 
Legislature contemplated this very type of development as being easily 
within the objective construct of a directly related purpose. The 
fundamental purpose has not been changed by the current proposal, 
which still turns, as before, on credit profile analysis. The proposal is 
therefore consistent with DPP3(b) of the PDPO. 


Apart from the MPF example cited in the Senior Counsel’s opinion at 
paragraphs 28 to 30, the Senior Counsel’s view is also supported by the 
Administrative Appeals Board (AAB) decision of #2/Af v Privacy 
Commissioner for Personal Data, AAB No. 41/2006. In this case, the 
appellant provided her personal data, including her name, address, and 


telephone number to the management company when she complained 
about the foul smell in the corridor outside her flat. The appellant had 
expressly told the representative of the management company that if it 
decided to make a report to the police, the management should preserve 
her anonymity. The AAB ruled that although the management company 
had promised the appellant that it would not disclose her personal data 
to the police, when the management company provided the appellant’s 
personal data to the police, it was using the personal data for a purpose 
which was directly related to a purpose for which her data were 
collected in the first place’. It is worth pointing out that in this case the 
ruling was made even though the transfer of information to the Police 
was not within her reasonable contemplation at the time the data was 
collected nor had she given her prescribed consent for the transfer. 


In addition, we would respectfully submit that the analogy to “bundled 
consent” issue as referred to in a recent AAB case is inappropriate. The 
case considered by the AAB was related to the use of personal data for 
an unrelated purpose i.e. transfer of personal data to a third party for 
marketing the third party’s good and services which was neither the 
Original Purpose nor a directly related purpose. On the other hand, 
DPP 3 does allow the use of data for original purposes and other 
purposes directly related to the original purposes. Based on the Senior 
Counsel’s opinion, the HKMA is of the view that the current proposal 
involves the data being used for a purpose directly related to a core 
business activity of credit providers, and therefore there should be no 
legal impediment for existing mortgage data to be contributed to the 
CRA for the purpose of the current proposal. 


Incidentally, in Section III of the "Guidance on the Collection and Use 
of Personal Data in Direct Marketing", it is noted that a data user may 
use personal data obtained from customers for marketing products or 
services directly related to the original purpose of collection of the data. 
As an example, it is stated that a bank may use personal data of its 
customers for marketing financial and insurance products. The 
Guidance Note also provides that, if at the time the data user collects 
the data it has no particular direct marketing activities in mind but 
subsequently decides to do so, then prior to conducting the direct 
marketing activities including the transfer of customers' personal data 
to third parties for the purpose of direct marketing, it must ensure that 
such use of data is directly related to the original purpose of collection 





On the facts of this case, section 58(2)(a)of the PDPO provides that personal data are exempt 
from the provisions of DPP3 anyway. However, the decision contains detailed analysis on the 
how DPP3 is to be applied and why the agreement between the data subject and the data user is 
irrelevant in considering whether DPP3 has been contravened. 


of data, and consider informing the customers of its intention to do (and 
reason for doing) so. 


Following from the above, if a data user is not required to obtain 
express consent from or notify a customer before using his personal 
data for marketing products and services directly related to the original 
purpose of collection of the data even though there was no such 
intention at that time, the same principle should clearly apply also to 
Issue 4 where the use of data directly relates to a core business activity 
of credit providers. To depart from this principle on this occasion will 
create inconsistency in the way the personal data privacy regime is 
administered. 


I would also like to point out that one of the intended purposes of the 
Industry Proposal is to avoid borrowers and speculators over-leveraging 
themselves. If we set aside the above legal issue and instead require 
the industry to seek prescribed consent from customers (although this is 
legally not required) before contributing existing mortgage data to the 
database, as proposed by the Law Society, the HKMA is concerned that 
this will render the credit database incomplete and significantly less 
useful. This is because customers with an intention to hide from the 
banks the accurate information relating to their existing mortgages 
would be unlikely to give their consent. This would mean that those 
who have not been declaring all relevant mortgage information to 
lending institutions when applying for credits or who intend to take 
excessive borrowing will be able to continue with their act of providing 
false information or omitting information in their loan applications 
without any objective means for the credit providers to verify their 
indebtedness. The direct result is that the group of borrowers with the 
intention to hide their full indebtedness or with excessive lending will 
most likely not be included in the database, despite the fact that these 
are exactly the group of borrowers that should be covered by the CRA. 
The database will therefore be deficient and will not serve the principal 
objective of the proposal. We would in fact find it difficult to 
understand the rationale for introducing any arrangement or 
requirement that will effectively defeat the ability of the CRA to serve 
the public interest angle (i.e. maintaining overall financial stability in 
Hong Kong) which supports the implementation of positive mortgage 
data sharing in the first place. 


In accordance with the spirit of PCO’s guidance in Section III of the 
Guidance mentioned above, I understand that your office has been 
exploring the alternative of requiring credit providers to take all 
reasonably practicable steps to issue notification to the mortgage 


customers before uploading of the existing mortgage data. As you are 
aware, the industry has obtained legal opinions confirming that 
customer notification is not necessary in these circumstances and they 
still have concerns about issuing such notification. That said, if you are 
of the view that the issue of customer notification is a good practice for 
enhancing transparency to customers and would provide you with the 
requisite comfort in allowing the uploading of existing mortgage data to 
the CRA, the HKMA will be happy to work with you and discuss with 
the industry with a view to requiring them to do this. We note this 
would also allay the concerns of the Consumer Council on this issue. 
The form of customer notification will take into account suggestions 
raised by the Consumer Council that the purpose(s) for which the 
consumer’s personal data are to be used should be clearly spelt out and 
that the notice should be presented in a font size easily readable by 
customers. 


We will provide you with our response to your further questions 
received by us yesterday as soon as possible. 


In line with the treatment of the HKMA’s submissions to you in 
response to the Consultation exercise, we will be posting this letter on 
the HKMA website. 


Yours sincerely, 


Arthur Yuen 
Deputy Chief Executive 


c.c. Policy 21 Limited 
The Chairman, Consumer Credit Forum 
The Chairman, HKAB 
The Chairman, DTCA 
FSTB (Attn: Miss Natalie Li) 


